Examkin

Question

Difficulty: Very hardViewing and Analyzing Cloud Audit Logs

A cloud security administrator must set up audit logging to track and analyze user access to Cloud SQL databases across all projects within an organization. The solution requires enabling Cloud SQL Data Access audit logging, aggregating and routing these logs to a central BigQuery dataset in a security project, and granting a security analyst least-privilege permissions to inspect these logs in both Logs Explorer and BigQuery. What is the correct sequence of steps to configure log generation, export routing, writer authorization, and analyst access?

  1. 1Enable DATA_READ and DATA_WRITE log types for the Cloud SQL Admin API in the organization's audit log configuration.
  2. 2Create an aggregated log sink at the organization level with a filter for Cloud SQL Data Access logs targeting the central BigQuery dataset.
  3. 3Grant the service account identity created by the log sink the BigQuery Data Editor role (roles/bigquery.dataEditor) on the target dataset.
  4. 4Grant the security analyst the Private Logs Viewer role (roles/logging.privateLogViewer) at the organization level.
  5. 5Grant the security analyst the BigQuery Data Viewer role (roles/bigquery.dataViewer) on the exported audit dataset.

Answer

The correct sequence begins by enabling Data Access audit logging for Cloud SQL, creating an aggregated organization log sink targeting BigQuery, granting the sink service account write access to the dataset, assigning the Private Logs Viewer role to the analyst for Cloud Logging, and finally granting BigQuery Data Viewer permissions for SQL analysis.
The workflow follows logical and administrative dependencies: log generation must first be enabled for the service; log collection and destination routing must then be established at the organization level; the sink's unique service account must be authorized to write to the destination dataset; and finally, least-privilege IAM permissions must be granted to the analyst for inspecting logs in both Logs Explorer (Private Logs Viewer) and BigQuery (BigQuery Data Viewer).

Step-by-Step Solution

1
Enable Audit Log Generation
Cloud SQL Admin API generates DATA_READ and DATA_WRITE audit events.
Data Access audit logs are disabled by default for most GCP services (except BigQuery). Enabling them in the IAM Audit Logs interface is mandatory to begin producing log entries.
2
Configure Aggregated Log Sink
Organization-wide audit entries are directed to the central BigQuery dataset.
An aggregated sink at the organization node ensures that logs across all child folders and projects are collected into one sink destination.
3
Authorize Writer Identity
The log sink service account receives write authorization on BigQuery.
GCP log sinks use dedicated writer service accounts. Without assigning roles/bigquery.dataEditor on the target dataset, exported logs will be dropped.
4
Grant Cloud Logging IAM Permissions
The security analyst gains permission to inspect private audit logs in Cloud Logging.
Standard roles/logging.viewer permissions do not grant access to Data Access logs. The roles/logging.privateLogViewer role is required.
5
Grant BigQuery Query Permissions
The security analyst can execute SQL queries against the audit log tables in BigQuery.
Permissions in Cloud Logging do not transfer to BigQuery; explicit roles/bigquery.dataViewer access on the sink dataset is required.

Key Concept

Configuring Cloud Audit Log Enablement, Sink Routing, Writer Service Account Authorization, and Private Log Access Control
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic